That's because of a change in the default setting for RequireLogin. It used to be set to true by default, which would force you to log into the app before viewing any pages, unless you changed the setting. However, as a result of some other discussions
(http://www.codeplex.com/FacebookToolkit/Thread/View.aspx?ThreadId=35399), I decided to change the default value for RequireLogin to false. Long story short, it's basically
because I think that makes a little more sense in light of Facebook making apps visible to anyone, not just people who are signed in to the app. Of course, now that I say that, I'm starting to rethink it, but that's how it works for now.

So, in your case, just make sure to run the following before calling Page_Init:

No, this is just for users that use FBML. The IFrame page has the AutoAdd property, which is somewhat similar. However, now that I look at it, it looks like it defaults to true (which is the opposite of the FBML page).

I think I'm going to add an issue to try to coordinate the work between the FBML and IFrame pages. I hadn't really looked into that code in a while, but it looks like we're duplicating a fair amount of work, and some things are being done a little differently.
I think these could each use a bit of cleaning up.